Administrators, and users whose role grants the per PBX right Can impersonate (Web Client), can open the Web Client logged in as another user on that PBX ("impersonation"). The right is off by default for new and existing roles, authorization is enforced server side (MTP-API), and every impersonation is written to the PBX audit log showing who impersonated whom.

1. Grant the right (skip for admins)

Admins can always impersonate. For non admin users:

1. Go to System → Roles & Rights and edit (or create) the role assigned to the user.
2. Open the PBX access tab, enable the target PBX and click its edit (pencil) button to open Instance rights.
3. Under Extensions, check Can impersonate (Web Client) and save.

The right is scoped per PBX: only the phone systems with this right checked are affected.

Instance rights, Extensions section: "Can impersonate (Web Client)" with its info tooltip.

2. Impersonate a user

1. Open the PBX and go to Extensions → Users.
2. On the target user's row, click the spy icon ("Open Web Client as this user").
3. A new tab opens the Web Client already signed in as that user.

The button is only visible to admins and users holding the right. Visibility is only cosmetic: the backend re-checks the permission on every request, so the UI cannot be bypassed.

PBX users list: the spy icon opens the Web Client as that user.

3. Auditing

Every impersonation is recorded in the PBX audit log: Reports → Audit Logs (also reachable from the PBX dashboard, "Event log"). The entry shows which portal user performed the impersonation (Performed by) and which PBX user was impersonated (Item changed), flagged with an orange Impersonation pill.

Audit log entries flagged with the orange "Impersonation" pill.

Notes

• The platform user editor (System → Users → User access tab) shows an informational banner on admin users explaining the feature and that it is logged.
• The System Owner extension cannot be impersonated (the button is disabled). 

Admin only informational banner on the platform user editor.